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"The MAILING DATE of this communication appears on the cover sheet with the correspondence address 

THE REPLY FILED 29 August 2005 FAILS TO PLACE THIS APPLICATION IN CONDITION FOR ALLOWANCE. 



1 



a) 



The reply was filed after a final rejection, but prior to or on the same day as filing a Notice of Appeal. To avoid abandonment of 
this application, applicant must timely file one of the following replies: (1) an amendment, affidavit, or other evidence, which 
places the application in condition for allowance; (2) a Notice of Appeal (with appeal fee) in compliance with 37 CFR 41.31; or 
(3) a Request for Continued Examination (RCE) in compliance with 37 CFR 1.114. The reply must be filed within one of the 
following time periods: 

The period for reply expires months from the mailing date of the final rejection. 



b) K The period for reply expires on: (1 ) the mailing date of this Advisory Action, or (2) the date set forth in the final rejection, whichever is later. In no 
event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of the final rejection. 
Examiner Note: If box 1 is checked, check either box (a) or (b). ONLY CHECK BOX (b) WHEN THE FIRST REPLY WAS FILED WITHIN TWO 
MONTHS OF THE FINAL REJECTION. See MPEP 706.07(f). 
Extensions of time may be obtained under 37 CFR 1 .1 36(a). The date on which the petition under 37 CFR 1 .1 36(a) and the appropriate extension fee have 
been filed is the date for purposes of determining the period of extension and the corresponding amount of the fee. The appropriate extension fee under 37 
CFR 1 .1 7(a) is calculated from: (1 ) the expiration date of the shortened statutory period for reply originally set in the final Office action; or (2) as set forth in (b) 
above, if checked. Any reply received by the Office later than three months after the mailing date of the final rejection, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 
NOTICE OF APPEAL 

2. □ The Notice of Appeal was filed on . A brief in compliance with 37 CFR 41 .37 must be filed within two months of the date 

of filing the Notice of Appeal (37 CFR 41 .37(a)), or any extension thereof (37 CFR 41 .37(e)), to avoid dismissal of the appeal. 
Since a Notice of Appeal has been filed, any reply must be filed within the time period set forth in 37 CFR 41 .37(a). 

AMENDMENTS 



3. □ The 

(a) 
(b) 
(c) 



proposed amendment(s) filed after a final rejection, but prior to the date of filing a brief, will not be entered because 
They raise new issues that would require further consideration and/or search (see NOTE below); 
They raise the issue of new matter (see NOTE below); 

They are not deemed to place the application in better form for appeal by materially reducing or simplifying the issues for 
appeal; and/or 

(d>n They present additional claims without canceling a corresponding number of finally rejected claims. 
NOTE: . (See 37 CFR 1.116 and 41.33(a)). 

4. □ The amendments are not in compliance with 37 CFR 1.121. See attached Notice of Non-Compliant Amendment (PTOL-324). 

5. □ Applicant's reply has overcome the following rejection(s): . 

6. □ Newly proposed or amended claim(s) would be allowable if submitted in a separate, timely filed amendment canceling 

the non-allowable claim(s). 

7.S^ For purposes of appeal, the proposed amendment(s): a) □ will not be entered, or b) (xf will be entered and an explanation of 
'how the new or amended claims would be rejected is provided below or appended. f* 
The status of the claim(s) is (or will be) as follows: 

Claim(s) allowed: . 

Claim(s) objected to: . 

Claim(s) rejected: 1-47 . 

Claim(s) withdrawn from consideration: . 

AFFIDAVIT OR OTHER EVIDENCE 

8. □ The affidavit or other evidence filed after a final action, but before or on the date of filing a Notice of Appeal will not be entered 

because applicant failed to provide a showing of good and sufficient reasons why the affidavit or other evidence is necessary 
and was not earlier presented. See 37 CFR 1.116(e). 

9. □ The affidavit or other evidence filed after the date of filing a Notice of Appeal, but prior to the date of filing a brief, will not be 

entered because the affidavit or other evidence failed to overcome all rejections under appeal and/or appellant fails to provide a 
showing a good and sufficient reasons why it is necessary and was not earlier presented. See 37 CFR 41.33(d)(1). 

10. □ The affidavit or other evidence is entered. An explanation of the status of the claims after entry is below or attached. 
REQUEST FOR RECONSIDERATION/OTHER 

11. The request for reconsideration has been considered but does NOT place the application in condition for allowance because: 
See Continuation Sheet. 

12. □ Note the attached Information Disclosure Statement(s). (PTO/SB/08 or PTO-1449) Paper No(s). 

13. □ Other: . 
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Continuation of 11. does NOT place the application in condition for allowance because: Applicant's arguments filed August 29, 2005 
have been fully considered but they are not persuasive. 

In considering the Applicant's arguments the following factual remarks are noted: 

(I) Applicant contends that Fishman does not teach or updating only a portion of the statistical model associated with the identifier. 

(II) Applicant contends that there is no teaching or suggestion to combine Porras and Fishman. 

(III) Applicant contends that removing a least recent record event from the statistical model is patentably distinct from the disclosure 
of Porras. 

(IV) Applicant contends that the Examiner failed to address the limitation storing the record event for each update interval in a 
history cache. 

(V) Applicant contends that that there is no teaching or suggestion to combine Porras, Sarkissian, Kawasaki, and Fishman. 

(VI) Applicant contends that Porras, Sarkissian, Fishman, Costa, and Aboulnaga do not show the limitations of claims 29-35. 

(VII) Applicant contends that Porras and Steinbiss fail to teach or suggest the limitations of claims 3 and 39, as Steinbiss does not 
update the statistical model. 

(VIII) Applicant contends that Steinbiss is a non-analogous art. 



In considering (I), Applicant contends that Fishman fails to teach or suggest updating only a portion of the statistical model associated 
with the identifier. Examiner respectfully disagrees. As asserted by Applicant, Fishman discloses a method for building predictive models, 
wherein the models are updated by processing the new transactional records only, (abstract; paragraph [0008]). Examiner further asserts 
that Fishman explicitly discloses that the aforementioned transactional records (i.e. record event) are associated with an identifier, (i.e. 
customer identifier/attribute; paragraphs [0021]-[0023]; Figure 1- Cust17). These records are observed by different transactional sources, 
wherein each transactional source contains records associated with an identical identifier (i.e. mi; paragraphs [0017]-[0020]). Examiner 
cites Figure 1, which expressly displays that each of aforementioned transactional sources (i.e. demographic customer data 10; click 
through log 12; and purchase table 14) includes various observed records (i.e. age; data; pagelD; productID) that all correspond to the 
identical share identifier, (i.e. cust17). Fishman further discloses that when a new transactional record becomes present, that the 
predictive model method updates the records contained in these transactional sources, which correspond to a specified common 
identifier (i.e. tmi ; paragraphs [0037]-[0041]; Figure 2-item 24). In the case which in the previous cited example, the method processes 
and updates all records that correspond to observations for customer 17 by processing each transactional source of data separately for 
that common identifier (paragraph [0024]). Subsequently, the portion of the statistical model that is updated corresponds to new 
transactional records, as opposed to recalculating/reprocessing all records that are represented within the aforementioned statistical 
model. This method, as disclosed by Fishman, is functionally equivalent to the Applicant's claimed limitation: updating only a portion of 
the statistical model associated with the identifier. Therefore, Examiner asserts that the predictive model as disclosed by Fishman shows 
the limitations of Applicant's invention and maintains rejections of claims 1, 37, and 45 under Porras in view of Fishman, as set forth in 
the final office action. 

In considering (II), Applicant contends that there is no teaching or suggestion to combine the references, Porras and Fishman. 
The examiner recognizes that obviousness can only be established by combining or modifying the teachings of the prior art to produce 
the claimed invention where there is some teaching, suggestion, or motivation to do so found either in the references themselves or in 
the knowledge generally available to one of ordinary skill in the art. See In re Fine, 837 F.2d 1071, 5 USPQ2d 1596 (Fed. Cir. 1988) and 
In re Jones, 958 F.2d 347, 21 USPQ2d 1941 (Fed. Cir. 1992). In this case, one of ordinary skill in the art would have been so motivated 
to combine or modify the teachings of the prior art in order to quickly update the statistical model, thereby improving processing speed as 
expressly taught by Fishman (paragraph [0037], lines 1-3). Therefore, Examiner maintains rejections of claims 1, 37, and 45 under 35 
USC 103(a) over Porras in view of Fishman, as set forth in the final office action. 

In considering (III), Applicant contends that removing a least recent record event from the statistical model is patentably distinct from the 
disclosure of Porras. Examiner respectfully disagrees. Examiner asserts that Porras explicitly discloses that a statistical algorithm 
reflects "recent" network activity via a short-term profile (i.e. model). Porras further discloses the aforementioned short-term profile 
accumulates values according to an aging mechanism. Subsequently, the short-term profile removes statistical records that have aged 
past configured parameters of the aging mechanism (i.e. least recent record event), in order to accumulate and maintain a profile (i.e. 
model) of the most recent network activity, (column 6). Therefore, Examiner maintains that Porras discloses Applicants limitations of 
removing a least recent record event from the statistical model, and thusly is not patentably distinct. As a result, Examiner maintains 
rejection of claims 2 and 38 under 35 USC 103(a) over Porras in view of Fishman, as set forth in the final office action. 

In considering (IV), Applicant contends that the Examiner failed to address the limitation storing the record event for each update interval 
in a history cache. For clarification to Applicant, the Examiner cites reference to this aforementioned limitation, as set forth in the final 
office action (page 9): 

In an art, Sarkissian discloses a method that involves employing a cache subsystem for storing flow-based statistical measures, and 
subsequent supports real-time network monitoring (column 2, lines 30-32; column 2, lines 50-67; column 3, lines 1-15; column 4, line 54 
to column 5, line 24; and column 1 9, line 55 to column 20, line 2). One of ordinary skill in the art would have been so motivated to 
implement this into feature into the aforementioned methodology as disclosed by Porras, so as to reduce latency time associated with 
memory accesses thereby improving process efficiency, (Sarkissian column 2, lines 57-67). 
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In considering (V), Applicant contends that that there is no teaching or suggestion to combine the references Porras, Sarkissian, 
Kawasaki, and Fishman. The examiner recognizes that obviousness can only be established by combining or modifying the teachings of 
the prior art to produce the claimed invention where there is some teaching, suggestion, or motivation to do so found either in the 
references themselves or in the knowledge generally available to one of ordinary skill in the art. See In re Fine, 837 F.2d 1071, 5 
USPQ2d 1596 (Fed. Cir. 1988) and In re Jones, 958 F.2d 347, 21 USPQ2d 1941 (Fed. Cir. 1992). In this case, one of ordinary skill in 
the art would have been so motivated to implement the feature as disclosed by Sarkissian into the aforementioned methodology as 
disclosed by Porras, so as to reduce latency time associated with memory accesses thereby improving process efficiency, (Sarkissian 
column 2, lines 57-67). This modification to the aforementioned method would have been obvious, because one of ordinary skill in the 
art would have been so motivated to identifier specific users, as disclosed by Kawasaki, in order to further correlate network activity 
records thereby improving detection of abnormal network activity, (Porras column 2, lines 54-64). In addition, one of ordinary skill in the 
art would have been so motivated to implement the features as disclosed by Fishman, into the aforementioned method in order to quickly 
update the model, thereby improving processing speed (Fishman paragraph [0037], lines 1-3). Therefore, Examiner maintains rejections 
of claim 23 under 35 USC 103(a) over Porras in view of Sarkissian, Kawasaki, and Fishman, as set forth in the final office action. 

In considering (VI), Applicant contends that Porras, Sarkissian, Fishman, Costa, and Aboulnaga do not show the limitations of 

claims 29-35. Examiner respectfully disagrees. Examiner asserts that the aforementioned references in combination teach and/or 
suggest the claimed limitations, and the motivation to combine these references as set forth below: 

In reference to claim 29, Porras discloses a method for network surveillance that includes real-time measuring and monitoring of network 
traffic, in order to subsequently generate network statistical profiles (abstract). Porras explicitly discloses: 

A method for analyzing a stream of network usage data over a rolling time (i.e. short-term or long-term) interval comprising, 
(column 1, lines 44-54; column 4, line 60 to column 5, line 3;column 5, line 30-52; and column 3, lines 42-54): 

Defining a statistical model for analyzing the stream of network usage data over the rolling time interval, (column 5, lines 30-52 
and column 6, lines 38-52); 

Defining the rolling time interval to include a plurality of update intervals, (column 2, lines 11-19 and column 5, lines 30-35; 
column 6, lines 38-52); 

Receiving a record event from the stream of data for each update time interval, (column 2, lines 11-19 and column 5, lines 30- 
35; column 6, lines 38-52); 

? Generating the statistical model over the rolling time interval using the statistical model and each record event, (column 2, lines 
11-19 and column 5, lines 30-35; column 6, lines 38-52); and 

Updating the statistical model using the statistical model and a most recent record event for a most recent update time interval, 
(column 2, lines 11-18 and column 6, lines 37-52). 

Although Porras disclose substantial features of the claimed invention, the reference fails to explicitly disclose: storing the record event 
for each update in a history cache; and generating a statistical model each record event stored in the history cache. Nonetheless, this 
would have been an obvious modification to the aforementioned method to one of ordinary skill in the art at the time of the invention, as 
further evidenced by Sarkissian. 

In an analogous art, Sarkissian discloses a method that involves employing a cache subsystem for storing flow-based statistical 
measures, and subsequent supports real-time network monitoring (column 2, lines 30-32; column 2, lines 50-67; column 3, lines 1-15; 
column 4, line 54 to column 5, line 24; and column 19, line 55 to column 20, line 2). One of ordinary skill in the art would have been so 
motivated to implement this into feature into the aforementioned methodology as disclosed by Porras, so as to reduce latency time 
associated with memory accesses thereby improving process efficiency, (Sarkissian column 2, lines 57-67). In addition, the references 
fail to disclose generating an aggregation table. Nonetheless, this would have been an obvious modification to the aforementioned 
method to one of ordinary skill in the art at the time of the invention, as further evidenced by Costa. 

In another analogous art, Costa discloses a method for network management in which an aggregation table is employed for tracking 
system data and generating statistical reports, (column 2, lines 21-31; column 8, lines 1-41; column 8, lines 53 to column 9, line 5). One 
of ordinary skill in the art would have been so motivated to implement this modification into the aforementioned method, so as to 
increase the ease of performing various actions (e.g. access, aggregate, extract, etc.) On relevant statistical data thereby increasing 
process efficiency, (Costa column 2, lines 15-18). In addition, the references fail to disclose updating only a portion of the statistical 
model associated with the most recent record event. Nonetheless, this would have been an obvious modification to the aforementioned 
method to one of ordinary skill in the art at the time of the invention, as further evidenced by Fishman. 

In another analogous art, Fishman discloses a method for generating statistical models, in which the aforementioned model is 
updated by processing only the newly available records, (paragraph [0008], lines 1-18; paragraph [0010], lines 1-5; and abstract). One of 
ordinary skill in the art would have been so motivated to implement this modification into the aforementioned method in order to quickly 
update the model, thereby improving processing speed (Fishman paragraph [0037], lines 1-3). In addition, although the references show 
substantial features to the claimed invention, the references fail to show explicitly the method generating a histogram statistical model 
representative of the network data, wherein the histogram having a first axis illustrating total usage defined by a number of bins, each bin 
having a usage variable range, and a second axis defined by a frequency corresponding to a number of users having a total usage within 
the usage variable range of each bin. Nonetheless, histogram statistical models were well known in the art at the time of the invention, as 
further evidenced by Aboulnaga. Therefore, this limitation would have been an obvious modification to the aforementioned method, as 
disclosed by the references, for one of ordinary skill in the art. 

In an analogous art, Aboulnaga discloses a method of building histogram statistical models, (column 5, line 37 to column 6, line 
3). Aboulnaga further shows building a histogram that includes a first axis defined a number of bins (i.e. bins; Figure 6-BUCKETS), each 
bin having a variable range (i.e. high to low; Figure 3; column 6, lines 30-55) and a second axis defined by a frequency (Figure 3&6) 
within the variable range of each bin, (columns 5-10). This modification would have been obvious to one of ordinary skill in the art, so as 
to increase the accuracy of the statistical model estimations and thereby increasing process effectiveness, (Aboulnaga column 1 lines 
54-55). 
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In reference to claim 30, Porras, Sarkissian, Fishman, and Costs and Fishman explicitly show the limitations, (Fishman paragraph 
[0008], lines 1-18; paragraph [0010], lines 1-5; and abstract). 

In reference to claims 31-36 Porras, Sarkissian, Fishman, and Costa explicitly show the limitations, (Porras column 2, lines 11-19 and 
column 5 t lines 30-35; column 6, lines 38-52; and Sarkissian column 2, lines 30-32; column 2, lines 50-67; column 3, lines 1-15; column 
4, line 54 to column 5, line 24; and column 19, line 55 to column 20, line 2). 

In considering (VII), Applicant contends that Porras and Steinbiss fail to teach or suggest the limitations of claims 3 and 39, as Steinbiss 
does not update the statistical model. As addressed in discussing (III), Examiner asserts that Porras discloses updating the statistical 
model, specifically removing a least recent record event from a statistical model, (Porras column 6). In addition, Examiner asserts that 
Steinbiss discloses storing a set of records in a history cache; and wherein the history cache is full, removing the least recent record from 
the aforementioned cache (column 5, line 60 to column 6, line 7). Therefore, the Examiner maintains that the combination of Porras and 
Steinbiss show all recited limitations of Applicant's claims 3 and 39 that is: storing the set of records in a history cache, ad wherein if the 
history cache is full removing a least recent record (Steinbiss), and updating the statistical model including removing a least recent 
record from the statistical model (Porras). ). Therefore, Examiner maintains rejections of claims 3 and 39 under 35 USC 103(a) over 
Porras in view of Steinbiss, as set forth in the final office action. 

In considering (VIII), Applicant contends that Steinbiss is nonanalogous art, it has been held that a prior art reference must either be in 
the field of applicant's endeavor or, if not, then be reasonably pertinent to the particular problem with which the applicant was concerned, 
in order to be relied upon as a basis for rejection of the claimed invention. See In re Oetiker, 977 F.2d 1443, 24 USPQ2d 1443 (Fed. Cir. 
1992). In this case, Steinbiss is related to employing statistical models that involve storing recently recognized elements (abstract; 
column 2, lines 25-38; and column 5, lines 15-30), which is pertinent to Applicant's to the problem with which the applicant in concerned, 
(i.e. efficiently generating statistical models from set of set of record events). Examiner also asserts that features cited from Steinbiss are 
under the broad scope of general statistical modeling methodology and thusly would easily be adaptable to the functionality of the 
invention as disclosed by Porras, as opposed to features that would be uniquely operable with vocabulary pattern recognition. Therefore, 
examiner maintains that Porras and Steinbiss are analogous art, and the combination would be readily recognizable to one of ordinary 
skill in the art at the time of invention, as set forth in the final office action. . 
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